Detections
Analytics

5.3.3.3.2 Ensure password history is enforced for the root user

Information

If the pwhistory enforce_for_root option is enabled, the module will enforce password history for the root user as well

By default the password-history check does not apply to the root account, so root can be changed back to a recently used password even when history enforcement is configured for other users. Enabling enforce_for_root subjects root's password changes to the same history check. Because the root account is a high-value target, preventing reuse of a recent - and possibly compromised - root password closes that gap.

Solution

Edit or add the following line in /etc/security/pwhistory.conf :

enforce_for_root

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 3f17ebf0f3821708c07f34b37534d1cbb483f19138a5f262d597eac1f050cdc9